test: extract PEM fixtures to resources and allowlist for gitleaks (crw-12394)

[adietish]

fixes https://redhat.atlassian.net/browse/CRW-12394

Move PEM certificates and private keys from inline Kotlin test strings into src/test/resources/tls/ and load them through TlsTestCertificates (readTlsResource, singleLine). Add .gitleaks.toml allowlist for that directory so secret scanners skip known test fixtures.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 6d2d6322-64d6-444a-9973-1753b9d65eb7

📥 Commits

Reviewing files that changed from the base of the PR and between 522da61 and 4801f67.

📒 Files selected for processing (1)

• src/test/kotlin/com/redhat/devtools/gateway/auth/tls/TlsTestCertificates.kt

🚧 Files skipped from review as they are similar to previous changes (1)

• src/test/kotlin/com/redhat/devtools/gateway/auth/tls/TlsTestCertificates.kt

---

📝 Walkthrough

Summary by CodeRabbit

• Tests

  • Consolidated TLS certificate and private-key test fixtures into shared resource-based fixtures.
  • Improved TLS fixture loading with UTF-8 handling and clear errors for missing resources.
  • Updated certificate-related tests to use reusable fixtures without changing test coverage or behavior.

• Chores

  • Refined secret-scanning exclusions and annotations for test certificate materials.

Walkthrough

The change centralizes TLS test certificates in classpath resources, updates tests to use shared fixtures, and adjusts Gitleaks configuration and notsecret comments. Runtime behavior and test assertions remain unchanged.

Changes

TLS fixture and secret scanning cleanup

Layer / File(s)	Summary
Shared TLS fixture provider src/test/kotlin/com/redhat/devtools/gateway/auth/tls/TlsTestCertificates.kt	TLS certificates and keys load from UTF-8 classpath resources. Additional fixtures, missing-resource handling, and PEM newline normalization are provided.
TLS fixture consumers src/test/kotlin/com/redhat/devtools/gateway/auth/tls/*, src/test/kotlin/com/redhat/devtools/gateway/openshift/*	TLS tests and OpenShift tests use shared certificate and key fixtures.
Secret scanning cleanup .gitleaks.toml, src/main/kotlin/com/redhat/devtools/gateway/auth/tls/PemUtils.kt, src/test/kotlin/com/redhat/devtools/gateway/kubeconfig/*, src/test/kotlin/com/redhat/devtools/gateway/openshift/ClusterTest.kt	Gitleaks allows TLS resource files. notsecret annotations are repositioned or removed from fixture data.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: ⚪ Minimal · up to 4801f

This PR moves PEM fixtures into test resources and updates test loading plus scanner allowlisting; no actionable merge-blocking risk remains beyond normal checks.

Suggested reviewers: vrubezhny, azatsarynnyy

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly summarizes extracting PEM fixtures and adding a Gitleaks allowlist.
Description check	✅ Passed	The description directly explains moving PEM fixtures to resources and configuring the Gitleaks allowlist.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[adietish]

@vrubezhny, @azatsarynnyy: please review

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 35.04%. Comparing base (71098f6) to head (4801f67).
⚠️ Report is 417 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##            main     #363       +/-   ##
==========================================
+ Coverage   0.00%   35.04%   +35.04%     
==========================================
  Files          4      113      +109     
  Lines         26     4916     +4890     
  Branches       0      945      +945     
==========================================
+ Hits           0     1723     +1723     
- Misses        26     2941     +2915     
- Partials       0      252      +252     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@src/test/kotlin/com/redhat/devtools/gateway/auth/tls/TlsTestCertificates.kt`:
- Around line 25-30: Update readTlsResource to wrap the InputStream returned by
getResourceAsStream in use before calling readBytes, preserving the existing
UTF-8 conversion and missing-resource error. Apply the same resource-closing
pattern to the four helper calls in TlsConnectionProbeTestFixtures.kt.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 0673339e-c8dc-4d43-bc32-4d5723e9c477

📥 Commits

Reviewing files that changed from the base of the PR and between 1167771 and 522da61.

⛔ Files ignored due to path filters (4)

• src/test/resources/tls/ca-cert.pem is excluded by !**/*.pem
• src/test/resources/tls/client-key.pem is excluded by !**/*.pem
• src/test/resources/tls/ec-cert.pem is excluded by !**/*.pem
• src/test/resources/tls/normalization-cert.pem is excluded by !**/*.pem

📒 Files selected for processing (12)

• .gitleaks.toml
• src/main/kotlin/com/redhat/devtools/gateway/auth/tls/PemUtils.kt
• src/test/kotlin/com/redhat/devtools/gateway/auth/tls/CertificateSourceTest.kt
• src/test/kotlin/com/redhat/devtools/gateway/auth/tls/PemUtilsTest.kt
• src/test/kotlin/com/redhat/devtools/gateway/auth/tls/TlsConnectionProbeTestFixtures.kt
• src/test/kotlin/com/redhat/devtools/gateway/auth/tls/TlsTestCertificates.kt
• src/test/kotlin/com/redhat/devtools/gateway/kubeconfig/BlockStyleFilePersisterTest.kt
• src/test/kotlin/com/redhat/devtools/gateway/kubeconfig/KubeConfigNamedUserTest.kt
• src/test/kotlin/com/redhat/devtools/gateway/kubeconfig/KubeConfigUtilsTest.kt
• src/test/kotlin/com/redhat/devtools/gateway/openshift/ApiClientUtilsTest.kt
• src/test/kotlin/com/redhat/devtools/gateway/openshift/ClusterTest.kt
• src/test/kotlin/com/redhat/devtools/gateway/openshift/OpenShiftClientBuilderTest.kt

💤 Files with no reviewable changes (2)

• src/test/kotlin/com/redhat/devtools/gateway/kubeconfig/KubeConfigNamedUserTest.kt
• src/test/kotlin/com/redhat/devtools/gateway/kubeconfig/BlockStyleFilePersisterTest.kt

[vrubezhny]

@coderabbitai review

[coderabbitai]

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[vrubezhny]

Looks good to me. Thanks!